feat: health check configuration and worker engine (Phase 3+4)

- Added health_check_poller.rs: periodic service/HTTP health checks
- Added pre-patch health gate in job_executor.rs
- Added waiting_health_check job status (migration 008)
- Added health_check_status to HostSummary and hosts API
- Added health check types and API functions to frontend
- Added health check UI section to HostDetailPage
- Added health check status indicators to HostsPage and PatchDeploymentPage
- Added serde default for health_check_poll_interval_secs
- Fixed missing AgentClient import in health_check_poller.rs
- Fixed missing ws_relay import in main.rs
- Fixed missing closing paren in retry_pending_jobs SQL
- Added ReadWritePaths for /etc/patch-manager/keys in systemd services

crates/pm-agent-client/src/client.rs

@@ -30,7 +30,7 @@ use crate::{
     error::AgentClientError,
     types::{
         AgentEnvelope, AgentJobStatus, ApplyPatchesRequest, ApplyPatchesResponse, HealthData,
-        PackagesData, PatchesData, RollbackResponse, SystemInfoData,
+        PackagesData, PatchesData, RollbackResponse, ServiceStatusData, SystemInfoData,
     },
 };
 
@@ -221,10 +221,17 @@ impl AgentClient {
             .await
     }
 
+    /// `GET /api/v1/system/services/{name}` — check status of a specific service on the agent.
+    #[instrument(skip(self), fields(base_url = %self.base_url, service_name = %service_name))]
+    pub async fn service_status(&self, service_name: &str) -> Result<ServiceStatusData, AgentClientError> {
+        self.get(&format!("system/services/{}", service_name), &[]).await
+    }
+
     // --------------------------------------------------------
     // Private POST helper
     // --------------------------------------------------------
 
+
     /// Execute a POST request against `{base_url}/{path}`, serialize `body` as
     /// JSON, deserialize the [`AgentEnvelope`], and extract the `data` field —
     /// or propagate an [`AgentClientError::ApiError`].

crates/pm-agent-client/src/lib.rs

@@ -39,5 +39,5 @@ pub use error::AgentClientError;
 /// Response envelope and all data types.
 pub use types::{
     AgentEnvelope, AgentErrorBody, HealthData, Package, PackagesData, Patch, PatchesData,
-    SystemInfoData,
+    RollbackResponse, ServiceStatusData, SystemInfoData,
 };

crates/pm-agent-client/src/types.rs

@@ -193,6 +193,23 @@ pub struct AgentJobStatus {
     pub completed_at: Option<DateTime<Utc>>,
 }
 
+// ============================================================
+// GET /api/v1/system/services/{name}
+// ============================================================
+
+/// Payload returned by `GET /api/v1/system/services/{name}`.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ServiceStatusData {
+    /// Service name.
+    pub name: String,
+    /// Service status string (e.g. `"running"`, `"stopped"`, `"failed"`).
+    pub status: String,
+    /// Whether the service is considered healthy.
+    pub healthy: bool,
+    /// Seconds elapsed since the service started (`null` if not running).
+    pub uptime_secs: Option<u64>,
+}
+
 // ============================================================
 // POST /api/v1/jobs/{id}/rollback
 // ============================================================